The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV320, Cisco Small Business RV325, Cisco Small Business RV016, Cisco Small Business RV042, and Cisco Small Business RV082 allows a attacker to cause service failures or execute arbitrary code with root privileges.

The vulnerability in the web-based administration interface of Cisco Small Business RV320, Cisco Small Business RV325, Cisco Small Business RV016, Cisco Small Business RV042, and Cisco Small Business RV082 arises from an operation that goes beyond the buffer limits in memory. Exploiting this...

Xiaomi Mi Jia ink-jet printer injection vulnerability

Xiaomi Mi Jia ink-jet printer is a multifunctional printer from China's Xiaomi Technology Xiaomi. A security vulnerability exists in versions prior to Xiaomi Mi Jia ink-jet printer 3.4.60138. The vulnerability can be exploited by an attacker to inject parameters into the ippserver via the web...

Unpatched Bugs in Oracle iPlanet Open Door to Info-Disclosure, Injection

A pair of vulnerabilities in Oracle’s iPlanet Web Server have been disclosed that can lead to sensitive data exposure and image injections onto web pages if exploited. However, no patch is forthcoming for either flaw. The bugs CVE-2020-9315 and CVE-2020-9314 are specifically found in the web...

Cross-Site Scripting (XSS)

samba is vulnerable to cross-site scripting XSS. A cross-site scripting XSS flaw was found in the password change page of the Samba Web Administration Tool SWAT. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead t...

[SECURITY] Fedora 31 Update: phpMyAdmin-5.0.2-1.fc31

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the Web. Currently it can create and drop databases, create/drop/alter tables, delete/edit/add fields, execute any SQL statement, manage keys on fields, manage privileges,export data into various formats a nd ...

CVE-2019-19964

On NETGEAR GS728TPS devices through 5.3.0.35, a remote attacker having network connectivity to the web-administration panel can access part of the web panel, bypassing authentication...

Authentication flaw

On NETGEAR GS728TPS devices through 5.3.0.35, a remote attacker having network connectivity to the web-administration panel can access part of the web panel, bypassing authentication...

Wing FTP Server 6.2.3 Cross Site Request Forgery

Exploit Title: Wing FTP Server 6.2.3 - Authenticated Cross Site Request Forgery Date: 2020-03-10 Exploit Author: Dhiraj Mishra Vendor Homepage: https://www.wftpserver.com Version: v6.2.6 Tested on: Windows 10 Summary: An authenticated CSRF exists in web client and web administration of Wing FTP...

Wing FTP Server 6.2.3 Cross Site Request Forgery Vulnerability

Exploit Title: Wing FTP Server 6.2.3 - Privilege Escalation Exploit Author: Dhiraj Mishra Vendor Homepage: https://www.wftpserver.com Version: v6.2.6 Tested on: Windows 10 Summary: An authenticated CSRF exists in web client and web administration of Wing FTP v6.2.6, a crafted HTML page could dele...

Wing FTP Server - Authenticated CSRF (Delete Admin)

Exploit Title: Wing FTP Server 6.2.3 - Privilege Escalation Date: 2020-03-10 Exploit Author: Dhiraj Mishra Vendor Homepage: https://www.wftpserver.com Version: v6.2.6 Tested on: Windows 10 Summary: An authenticated CSRF exists in web client and web administration of Wing FTP v6.2.6, a crafted HTM...

CVE-2019-19226

A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface Firmware EU1.03 allows an attacker to enable or disable MAC address filtering by submitting a crafted Forms/WlanMacFilter1 POST request without being authenticated on the admin interface...

Cross site scripting

A Stored XSS issue in the D-Link DSL-2680 web administration interface Firmware EU1.03 allows an authenticated attacker to inject arbitrary JavaScript code into the info.html administration page by sending a crafted Forms/wirelessautonetwork1 POST request...

Improper access control

A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface Firmware EU1.03 allows an attacker to change DNS servers without being authenticated on the admin interface by submitting a crafted Forms/dns1 POST request...

Improper access control

A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface Firmware EU1.03 allows an attacker to download the configuration binary file settings by submitting a rom-0 GET request without being authenticated on the admin interface...

CVE-2019-19224

The CVE-2019-19224 entry relates to a Broken Access Control in the D-Link DSL-2680 web administration interface (EU_1.03 firmware). An unauthenticated attacker can download the device configuration (binary) by issuing a rom-0 GET request to the admin interface. Public sources confirm affected pro...

CVE-2019-19223

A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface Firmware EU1.03 allows an attacker to reboot the router by submitting a reboot.html GET request without being authenticated on the admin interface...

CVE-2019-19223

The CVE-2019-19223 issue affects the D-Link DSL-2680 router (EU firmware EU_1.03) where the web administration interface’s reboot.html endpoint is accessible without authentication. Root cause: Broken access control in the admin UI allows an unauthenticated user to trigger a reboot, impacting ava...

PT-2020-10104 · D Link · D-Link Dsl-2680

Name of the Vulnerable Software and Affected Versions: D-Link DSL-2680 version EU 1.03 Description: A Broken Access Control issue in the web administration interface allows an attacker to change DNS servers without authentication by submitting a crafted Forms/dns 1 POST request. Recommendations:...

PT-2020-10105 · D Link · D-Link Dsl-2680

Name of the Vulnerable Software and Affected Versions: D-Link DSL-2680 version EU 1.03 Description: A Broken Access Control issue in the web administration interface allows an attacker to enable or disable MAC address filtering by submitting a crafted "Forms/WlanMacFilter 1" POST request without...

Netis WF2419 Remote Code Execution Vulnerability

The Netis WF2419 is a 300Mbps wireless router. A remote code execution vulnerability exists in Netis WF2419 1.2.31805, 2.2.36123. The vulnerability stems from a lack of validation of user input. An authenticated attacker can exploit this vulnerability to execute system commands as root via a web...